What is PKI (Public Key Infrastructure)?

The cryptographic framework — keys, certificates, and authorities — that backs digital signatures and HTTPS.

Public Key Infrastructure (PKI) is the system of hardware, software, policies, and procedures that creates, manages, distributes, uses, stores, and revokes digital certificates and public keys. PKI underpins HTTPS (TLS certificates), email signing (S/MIME), and digital signatures (X.509). A trusted Certificate Authority (CA) issues a certificate that binds a public key to an identity; anyone with the public key can verify a signature made by the corresponding private key.

Asymmetric cryptography

PKI uses key pairs: a private key (kept secret by the holder) and a public key (shared widely). Anything encrypted with the public key can only be decrypted with the private key, and vice versa. A digital signature is the holder using their private key to encrypt a hash of the document; verifiers decrypt with the public key and compare hashes.

Certificate Authorities

A CA is the trusted third party that vouches for the identity-to-key binding. For digital signatures, EU-recognized Qualified Trust Service Providers (QTSPs) are the equivalent CAs. For HTTPS, browser-trusted CAs (DigiCert, Let's Encrypt, etc.) issue server certificates.

PKI in PDF Verified

PDF Verified uses PKI for HTTPS transport (TLS 1.3, all routes), document hashing (SHA-256, every signed PDF), and — on Business Plus — TSP-backed Advanced Electronic Signatures where each signer's identity is bound to a certificate.